Tadle

Vulnerability Details

The TokenManager.sol contract features a whenNotPaused modifier that is currently only applied to the withdraw() function. This limited application of the pausing functionality could leave critical operations exposed during emergencies, potentially jeopardizing the safety of staked assets and reward distributions.

TokenManager.sol#L137-L140

Other critical functions in TokenManager.sol, PreMarkets.sol, and DeliveryPlace.sol are not protected by the pausing mechanism, including:

• tillIn() in TokenManager.sol

• createOffer(), createTaker(), listOffer(), closeOffer(), relistOffer(), abortAskOffer(), and abortBidTaker() in PreMarkets.sol

• closeBidOffer(), closeBidTaker(), settleAskMaker(), and settleAskTaker() in DeliveryPlace.sol

Impact

The lack of comprehensive pause functionality exposes the contracts to potential issues if they need to be paused for maintenance or in response to an attack. By not restricting all non-essential functions during a pause, users can still interact with the contracts in ways that may not be intended during a paused state. This could lead to:

• Unauthorized transactions during a security breach.

• Potential loss of tokens if a vulnerability is exploited before a fix can be applied.

• Increased risk to user assets, as pausing is a common safeguard to mitigate damage during incidents.

Recommendations

Apply whenNotPaused modifier to mentioned critical functions.